CuteNews <= 1.4.1 (categories.mdu) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl cijfer-cnxpl - CuteNews =1.4.1 Remote Command Execution Copyright c 2005 cijfer [email protected] All rights reserved. 1. example cijfer@kalma:/research$ ./cijfer-cnxpl.pl -h www.xxxx.org -d /news [email protected] /$ id;uname -a uid=48apache...

FarsiNews 2.1/2.5 show_archives.php template Parameter Traversal Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/16580/info FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit the...

CuteNews 0.88/1.3 show_archives.php id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10620/info It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. The problems present...

CVE-2005-3507: Undefined Security Weakness

Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges via "../" sequences in the template parameter to 1 showarchives.php and 2 shownews.php...

CuteNews1.4.1.txt

CuteNews 1.4.1 Arbitrary file inclusion / remote code execution exploit software: site: http://cutephp.com/ description: "Cute news is a powerful and easy for using news management system that use flat files to store its database. It supports comments, archives, search function, image uploading,...

CuteNews < 1.3.2 XSS Vulnerability

CuteNews is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cutephp:cutenews...

CVE-2004-1660

CVE-2004-1660 affects CuteNews 1.3.6 and earlier. The vulnerability is a PHP remote file inclusion via the cutepath parameter to show_archives.php or show_news.php, enabling remote code execution. Public references (NVD entry) confirm the affected software, vulnerability class, and attack vector ...

CVE-2004-1660: Undefined Security Weakness

PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to 1 showarchives.php or 2 shownews.php...

CuteNews show_archives.php archive Parameter XSS

According to its banner, the version of CuteNews on the remote host is affected by a cross-site scripting XSS vulnerability due to a failure to sanitize input to the 'archive' parameter of the showarchives.php script. An unauthenticated, remote attacker can exploit this, via a specially crafted...

CVE-2004-0660: Undefined Security Weakness

Cross-site scripting XSS vulnerability in 1 showarchives.php, 2 shownews.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter...